| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
programs/fsverity: add --out-merkle-tree and --out-descriptor options Make 'fsverity digest' and 'fsverity sign' support writing the Merkle tree and fs-verity descriptor to files, using new options '--out-merkle-tree=FILE' and '--out-descriptor=FILE'. Normally these new options aren't useful, but they can be needed in cases where the fs-verity metadata needs to be consumed by something other than one of the native Linux kernel implementations of fs-verity. This is different from 'fsverity dump_metadata' in that 'fsverity dump_metadata' only works on a file with fs-verity enabled, whereas these new options are for the userspace file digest computation. Link: https://lore.kernel.org/r/20210603195812.50838-5-ebiggers@kernel.org Reviewed-by: Victor Hsieh <victorhsieh@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com> | 5 年前 | |
programs/fsverity: Add dump_metadata subcommand Add a 'fsverity dump_metadata' subcommand which calls FS_IOC_READ_VERITY_METADATA on a file and prints the returned metadata to stdout. There are three subsubcommands, one for each type of metadata that can be read using the ioctl: fsverity dump_metadata merkle_tree FILE fsverity dump_metadata descriptor FILE fsverity dump_metadata signature FILE By default the whole metadata item is dumped. --length and --offset can be specified to dump only a particular range of the item. This subcommand will be used by xfstests to test the FS_IOC_READ_VERITY_METADATA ioctl. Link: https://lore.kernel.org/r/20210115182402.35691-3-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> | 5 年前 | |
Remove unneeded include Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com> Link: https://lore.kernel.org/r/20201217192516.3683371-1-luca.boccassi@gmail.com Signed-off-by: Eric Biggers <ebiggers@google.com> | 5 年前 | |
upgrade to v1.6 ee7d74d75a727463046bf380b3de9e602a6e2b40 Signed-off-by: fundavid <fangjiawei8@huawei.com> | 1 年前 | |
Implement PKCS#11 opaque keys support through OpenSSL pkcs11 engine PKCS#11 API allows us to use opaque keys confined in hardware security modules (HSMs) and similar hardware tokens without direct access to the key material, providing logical separation of the keys from the cryptographic operations performed using them. This commit allows using the popular libp11 pkcs11 module for the OpenSSL library with fsverity so that direct access to a private key file isn't necessary to sign files. The user needs to supply the path to the engine shared library (typically the libp11 shared object file) and the PKCS#11 module library (a shared object file specific to the given hardware token). The user may also supply a token-specific key identifier. Test evidence with a hardware PKCS#11 token: $ echo test > dummy $ ./fsverity sign dummy dummy.sig \ --pkcs11-engine=/usr/lib64/engines-1.1/libpkcs11.so \ --pkcs11-module=/usr/local/lib64/pkcs11_module.so \ --cert=test-pkcs11-cert.pem && echo OK; Signed file 'dummy' (sha256:c497326752e21b3992b57f7eff159102d474a97d972dc2c2d99d23e0f5fbdb65) OK Test evidence for regression check (checking that regular file-based key signing still works): $ ./fsverity sign dummy dummy.sig --key=key.pem --cert=cert.pem && \ echo OK; Signed file 'dummy' (sha256:c497326752e21b3992b57f7eff159102d474a97d972dc2c2d99d23e0f5fbdb65) OK Signed-off-by: Aleksander Adamowski <olo@fb.com> [EB: Avoided overloading the --key option and keyfile field, clarified the documentation, removed logic from cmd_sign.c that libfsverity already handles, and many other improvements.] Link: https://lore.kernel.org/r/20210909212731.1151190-1-olo@fb.com Signed-off-by: Eric Biggers <ebiggers@google.com> | 4 年前 | |
Clarify the purpose of built-in signatures Signed-off-by: Eric Biggers <ebiggers@google.com> | 4 年前 | |
Implement PKCS#11 opaque keys support through OpenSSL pkcs11 engine PKCS#11 API allows us to use opaque keys confined in hardware security modules (HSMs) and similar hardware tokens without direct access to the key material, providing logical separation of the keys from the cryptographic operations performed using them. This commit allows using the popular libp11 pkcs11 module for the OpenSSL library with fsverity so that direct access to a private key file isn't necessary to sign files. The user needs to supply the path to the engine shared library (typically the libp11 shared object file) and the PKCS#11 module library (a shared object file specific to the given hardware token). The user may also supply a token-specific key identifier. Test evidence with a hardware PKCS#11 token: $ echo test > dummy $ ./fsverity sign dummy dummy.sig \ --pkcs11-engine=/usr/lib64/engines-1.1/libpkcs11.so \ --pkcs11-module=/usr/local/lib64/pkcs11_module.so \ --cert=test-pkcs11-cert.pem && echo OK; Signed file 'dummy' (sha256:c497326752e21b3992b57f7eff159102d474a97d972dc2c2d99d23e0f5fbdb65) OK Test evidence for regression check (checking that regular file-based key signing still works): $ ./fsverity sign dummy dummy.sig --key=key.pem --cert=cert.pem && \ echo OK; Signed file 'dummy' (sha256:c497326752e21b3992b57f7eff159102d474a97d972dc2c2d99d23e0f5fbdb65) OK Signed-off-by: Aleksander Adamowski <olo@fb.com> [EB: Avoided overloading the --key option and keyfile field, clarified the documentation, removed logic from cmd_sign.c that libfsverity already handles, and many other improvements.] Link: https://lore.kernel.org/r/20210909212731.1151190-1-olo@fb.com Signed-off-by: Eric Biggers <ebiggers@google.com> | 4 年前 | |
programs/test_compute_digest: test the metadata callbacks Test that the libfsverity_metadata_callbacks support seems to be working correctly. Link: https://lore.kernel.org/r/20210603195812.50838-3-ebiggers@kernel.org Reviewed-by: Victor Hsieh <victorhsieh@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com> | 5 年前 | |
Switch to MIT license This allows libfsverity to be used by software with other common licenses, e.g. LGPL, MIT, BSD, and Apache 2.0. It also avoids the incompatibility that some people perceive between OpenSSL and the GPL. See discussion at https://lkml.kernel.org/linux-fscrypt/20200211000037.189180-1-Jes.Sorensen@gmail.com/T/#u Link: https://lkml.kernel.org/linux-fscrypt/20200731191156.22602-1-ebiggers@kernel.org Acked-by: Chris Mason <clm@fb.com> # FB copyrighted material Acked-by: Jes Sorensen <jsorensen@fb.com> Signed-off-by: Eric Biggers <ebiggers@google.com> | 5 年前 | |
Switch to MIT license This allows libfsverity to be used by software with other common licenses, e.g. LGPL, MIT, BSD, and Apache 2.0. It also avoids the incompatibility that some people perceive between OpenSSL and the GPL. See discussion at https://lkml.kernel.org/linux-fscrypt/20200211000037.189180-1-Jes.Sorensen@gmail.com/T/#u Link: https://lkml.kernel.org/linux-fscrypt/20200731191156.22602-1-ebiggers@kernel.org Acked-by: Chris Mason <clm@fb.com> # FB copyrighted material Acked-by: Jes Sorensen <jsorensen@fb.com> Signed-off-by: Eric Biggers <ebiggers@google.com> | 5 年前 | |
programs/utils: add full_pwrite() and preallocate_file() These helper functions will be used by the implementation of the --out-merkle-tree option for 'fsverity digest' and 'fsverity sign'. Link: https://lore.kernel.org/r/20210603195812.50838-4-ebiggers@kernel.org Reviewed-by: Victor Hsieh <victorhsieh@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com> | 5 年前 | |
programs/utils: add full_pwrite() and preallocate_file() These helper functions will be used by the implementation of the --out-merkle-tree option for 'fsverity digest' and 'fsverity sign'. Link: https://lore.kernel.org/r/20210603195812.50838-4-ebiggers@kernel.org Reviewed-by: Victor Hsieh <victorhsieh@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com> | 5 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 5 年前 | ||
| 5 年前 | ||
| 5 年前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 4 年前 | ||
| 4 年前 | ||
| 5 年前 | ||
| 5 年前 | ||
| 5 年前 | ||
| 5 年前 | ||
| 5 年前 |